Neither is a viable option, otherwise all the big players would've done this a long time ago. Nothing is stopping you from creating a throwaway account on Gmail while someone using a custom domain might be your new B2B lead. There's no realistic way to tell which it is simply from the domain.

I think they were referring to actual throwaway email providers. Companies that specifically provide that as a service.

There's a couple of great open source projects[1][2][3] that try to keep up-to-date lists of domains that belong to disposable email providers.

I would probably not recommend implementing a whitelist for blocking purposes. But perhaps domains on a whitelist could get a slight scoring bump.

[1] https://github.com/disposable-email-domains/disposable-email... [2] https://github.com/disposable/disposable [3] https://github.com/unkn0w/disposable-email-domain-list

As for abuse, I made myself a tool to give myself quintillions of email addresses (not using plus addressing) on gmail.com

I use this to sign up for a service with a unique email that is basically my junk box, but the email is its own unique entry in my password manager

I don't see how you could know what everyone's personal domain is to whitelist.